1

I'm having difficulty getting a particular IIS machine to "do" SSL. This is a test environment (one of many) which we've set up "the same" as we have many times previously, but it just doesn't seem to be working.

The server is Windows Server 2003 (Version 5.2 (Build 3790.srv03_sp2_gdr.100216-1301 : Service Pack 2))

IIS is hosting 4 sites (including the default site), but only one site is configured for SSL. We're using the same SSL certificate we use on all of our other servers (it's a wildcard cert).

(Don't think this is relevant, but including anyway) We've configured the site to require SSL, it has a subdirectory that doesn't require SSL but has an asp page that redirects into SSL. The 403;4 error page for the site is hooked up to this asp page (this is how we do our non-HTTPS into HTTPS transition).

Using Microsoft Network Monitor (3.3), I've just run a session against a server where SSL is working. It can pull apart the SSL exchange as the following messages:

SSL: Client Hello
SSL: Server Hello. Certificate. Server Hello Done
SSL: Client Key Exchange. Change Cipher Spec. Encrypted Handshake Message.
SSL: Change Cipher Spec. Encrypted Handshake Message

However, on our problem server, I only see:

SSL: Client Hello.

The next packet from the server (from port 443, so it's listening and responding there) contains only 60 bytes, and just seems to have the Tcp headers and not much else (but I'm by no means an expert at deciphering these things).

So, where do I look next? Or what additional information do I need to add to this question, and where do I find it?

1 Answer 1

0

And in typical fashion, having gone through writing this issue, we managed to find the fault shortly afterwards:

It turns out there was something wrong with this server's copy of the SSL certificate (despite it all appearing correct in IIS manager, including the message about having the matching private key). No amount of restarting the site in IIS, accessing the site via SSL, or unassigning/re-assigning the certificate resulted in any messages in the event logs.

We had to delete the certificate and re-import it from file.

We have a suspicion that this server may have been cloned at some point, so it may have been something to do with the cloning process. Leaving this extra tidbits as an answer, in the hope that it helps someone else in the future.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .